Orel Pery

[Orel Pery @Orelpery]

@dan_livne is smashing it

[Amir Barkol @BarkolAmir]

אף אחד:
מפתחים במיקרוסופט באמצע יום עבודה:

[Orel Pery @Orelpery]

@_MatiasMichael @cais Interesting

[Orel Pery @Orelpery]

Great research by @AsafHaski!
#IOC #Russia #China #cybersecurity #threatintell

[CyberProof @cyberproofinc]

⚠️ How do #MaliciousActors bypass geolocation bans? Our #CTI Research Report maps out some of the data & statistics collected & analyzed by the CTI team. Download the report: ➡️ https://t.co/q6heoZqn2n #CyberThreatIntelligence #IOCs #IndicatorsOfCompromise #Russia #Ukraine

[Orel Pery @Orelpery]

Great analysis by Omri Matsa, CTI Analyst @ @cyberproofinc

https://t.co/Q7RcTBooUc

[CyberProof @cyberproofinc]

⚠️ What are the most common #MITRE techniques observed in #MalwareAttacks? In our latest blog, Omri Matsa, #CyberThreatIntelligence Analyst seeks to take a focused snapshot of the malware-related threat landscape from January to July 2022. Read more: ➡️ https://t.co/KdWM1fyino

[Christopher Glyer @cglyer]

@_k00s #log4j Mitigation good/better/best

Good: block outbound LDAP & RMI ports
Better: block outbound LDAP & RMI protocols (regardless of port)
Best: block all outbound traffic

Reminder: orgs have 3rd party software that may not have patch for months & will be vulnerable for a while

[Orel Pery @Orelpery]

!!!סחתיין ענק
מרתק ואיכותי
@GelosSnake
https://t.co/dD8U2bW29H

[חזי לפלסיאן @HezyLaplacian]

אשכנזים חייבים למצוא תחביבים באמא שלי

[Orel Pery @Orelpery]

@amitaiz רק נינג'ה פודי

[Orel Pery @Orelpery]

@GelosSnake Interesting!

[Vadim Khrykov @BlackMatter23]

Hunting for @MITREattack T1197 - BITS Jobs🎯
- 5 procedures + emulation steps
- 8 detection ideas
- 21 rules (Windows/Sysmon/EDR)
Check out the rules here:
https://t.co/MkdnJecnr8

#threathunting

[ZDNET @ZDNET]

SynAck ransomware group releases decryption keys as they rebrand to El_Cometa https://t.co/7rAxLbvrLW

[Vanja Svajcer @vanjasvajcer]

Signed MSI files, Raccoon and Amadey are used for installing ServHelper RAT https://t.co/BmgLP0qiN4

[Will @BushidoToken]

Public reports of threat actors exploiting #PrintNightmare:

- BazarLoader/Conti ransomware
- Magniber ransomware
- ViceSociety ransomware
- PurpleFox EK

Any others? Comment below 👇

[Kelsey LaBelle @punsandrosess]

I wrote a blog post that includes a cheeky little cheat sheet that highlights DNS record types, observations, & potential indications that I hope folks find useful.
I also covers some foundational information on DNS so you can be the "authority" on DNS 😀

https://t.co/IYdua5mUzz

[eko Engineering @EkoEngi]

Thank you so much, @Orelpery, for being a guest speaker at our #ekoTechTalks program and teaching us about all the fun stuff, legal or otherwise, we can buy or do on the #DarkWeb!

[Vadim Khrykov @BlackMatter23]

Continue #REvil TTPs hunting campaign🎯
+8 detection ideas & 18 rules:
- T1053 - Scheduled Task/Job
- T1134.001 - Token Impersonation/Theft
- T1548.002 - Bypass UAC
https://t.co/kzkpG061Rf

I'd like to thank @TheDFIRReport team for provided clarifications!

#threathunting

[Israel Defense Forces @IDF]

What’s 9.3 miles (15 km)?

163 football fields
46 Eiffel Towers
34 Empire State Buildings
18 Burj Khalifas
Nearly 2 Mt. Everests

Our fighter jets neutralized 9.3 miles of the Hamas 'Metro' terror tunnel system overnight.

That's 9.3 miles that can no longer be used for terror.

[Orel Pery @Orelpery]

@DamskyIrena @BsidesTLV @SecurityBSides @Reutooo_ @CyberWeekTLV @cyberproofinc

[Israel Defense Forces @IDF]

Millions of Israeli civilians are running to bomb shelters as sirens sound across the country.

[Louis Dion-Marcil @ldionmarcil]

idk why I havent thought of this before, but its very easy to hide those "external sender" warnings that get appended to your emails during phishing campaigns 🤔. Email gateways/FW just add HTML at the start/end of emails, simply add CSS to hide it! #RedTeam

See images: